For reference:
It looks as though one is stuck with having the files in the public_html folder.
I sorted the access thing by using the 'Directory Protection' feature in the 'Site Management' menu to restrict the permissions on the folder to just the appropriate user.
Pat